PT-2024-22617 · Umbraco · Umbraco

Poan21 · Published 2024-03-20 · Updated 2024-03-25 · CVE-2024-28868

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Umbraco 10 versions prior to 10.8.4 Umbraco 10 version 10.8.5 is not affected as it contains the fix.

Description Umbraco is an ASP.NET content management system. A user enumeration attack is possible when access to the native login screen is available. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

Recommendations For Umbraco 10 versions prior to 10.8.4, update to version 10.8.5 to resolve the issue. As a temporary workaround, consider disabling the native login screen by exclusively using external logins until a patch is applied.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-204

Related Identifiers

CVE-2024-28868

GHSA-552F-97WF-PMPQ

Affected Products

Umbraco

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28868.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpq · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d · Patch
• https://osv.dev/vulnerability/GHSA-552f-97wf-pmpq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28868 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28868 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://t.me/cvenotify/74294 · Telegram Post
• https://twitter.com/RedPacketSec/status/1772202414046622000 · Twitter Post